Agentic Commerce Disputes: Who Holds the Evidence?
Card networks and AI platforms are shipping agentic payment rails. Every one of them authorizes the charge. A credential is presented, a cryptogram validates, the payment clears. None of them produces evidence of the mandated task. Payment authorization proves a credential holder consented to a charge. Task authorization proves the human approved what the agent actually did: what to buy, from whom, up to how much, until when. Two different objects. Today only one of them produces an artifact.
One dispute, end to end
A customer instructs a shopping agent to keep the household stocked. A monthly ceiling. A short list of approved merchant categories. The agent holds a delegated token and runs for weeks without incident. In week three it executes a purchase in a merchant category the human never approved, at four times the usual order size. The token is valid. The cryptogram is valid. The charge authorizes. The customer disputes it.
Now inventory what each party holds. The cardholder holds a claim and a chat transcript. The platform holds its own logs. Those logs were produced by the software whose conduct is in question, and they are the platform's own account of what happened. The issuer holds an authorization trail proving a valid credential was presented. That was never the question.
The investigation becomes three parties arguing about a mandate none of them can produce. It ends in an allocation of loss, and the allocation is argued rather than proven.
When the mandate is a signed object
The alternative starts before the agent runs. The human signs the mandate on their enrolled device: amount ceiling, counterparty scope, expiry, sealed into an Authoritative-tier payload with a hardware-bound key. Yuthent produces and verifies the signature and the payload hash. Your verify step checks each agent action against the signed mandate before execution. An action outside it is refused at your gate, and the refusal lands in the ledger.
Re-run the week-three purchase against that architecture. Either the action verified against the mandate, or it never executed. In both branches the investigation holds an artifact: an ES256 signature, independently verifiable against a published key, bound to the parameters the human actually approved.
The timing objection
The standard objection is temporal. The human approved at T0. The agent executed at T1. Nothing at T1 involved a human. Mandate binding is the answer. The T0 signature covers the parameters the agent must stay inside, and your backend verifies every T1 action against them. A T1 action inside the mandate carries the mandate's authority. A T1 action outside it fails at your verify step.
The proof is evidence. Adjudication belongs to your dispute process, your regulator, or your court. The artifact exists, it is independently verifiable, and it is bound to what the human approved. That is the whole claim, and it is enough to change how the investigation ends.
Common questions
What does an issuer hold today when an agent-initiated charge is disputed?
An authorization trail. It proves a valid credential and a valid cryptogram were presented. It says nothing about the task the human mandated, and the only task records are logs produced by the platform under dispute.
Does the mandate have to name every merchant in advance?
No. The mandate is whatever your policy defines and the human signs: an amount ceiling, a category scope, a named list, an expiry. Yuthent signs and verifies the payload hash. Your verify step defines the scope semantics and checks each action against them.
Who decides the dispute once the proof exists?
Your dispute process, your regulator, or your court. The proof is evidence, independently verifiable as ES256 against a published key and bound to the mandate parameters. Adjudication stays where it belongs.